> ## Documentation index
> The full klickops handbook index is at https://klickops.io/llms.txt
> The HTML of this page is at https://klickops.io/en/docs/registries
> Language: en

# Pull credentials and the build registry

Where klickops gets images it cannot reach anonymously, and where images it builds are stored.

## Two different things

They sound alike and do opposite jobs.

| | What it is | Direction |
| --- | --- | --- |
| Pull credentials | Login details for a registry your images live in | klickops reads from it |
| Build registry | Where klickops puts images it builds for you | klickops writes to it |

Most projects need neither. Public images need no credentials, and builds go to the registry klickops runs unless you point them elsewhere.

## Pull credentials

Add these when a deployment fails because the image cannot be pulled and the image is private. A public image that fails to pull has a different problem, usually a typo in the tag.

1. Go to **Registries** in the organization.
2. Add the registry host, a username and a token. Use a token or a deploy key rather than a password, because that is what you can revoke without changing your own login.
3. Deploy again. Apps in the organization can now use images from that host.

The token is stored as a secret and never shown back, exactly like every other [secret](/docs/secrets).

## The build registry

When klickops builds from a repository, the resulting image has to live somewhere. By default that is the registry klickops runs itself, and nothing leaves the platform.

Point it elsewhere when your own systems need to pull those images too, or when policy says artifacts belong in your own registry. You supply the host and credentials that may push, and builds go there instead.

## Settings reference

| Setting | Default | What it does |
| --- | --- | --- |
| Host | none | The registry hostname, for example `ghcr.io` or `registry.example.com`. |
| Username | none | The account or robot doing the pull. |
| Token | none | Write-only. Replaceable, never readable. |
| Build registry | klickops-internal | Where built images are pushed. |

## Limits and gotchas

- **Credentials are per organization, not per project.** Adding one makes it available to every project in the organization.
- **Changing a build registry does not move old images.** Existing deployments keep pulling from where their image actually is.
- **A rotated token breaks pulls silently until the next one.** Running workloads keep running, because the image is already on the node; the failure appears at the next deploy or restart.
- **Some registries need the full path, not just the host.** If a pull keeps failing with correct credentials, check whether the reference includes the project or namespace segment the registry expects.

## Related

- [Apps](/docs/apps) is where a private image is used.
- [Deploying from Git](/docs/git) is what pushes to the build registry.